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From: 

Sent: 06 February 2020 14:25 
To: SARguidance 

Subject: Consultation feedback 


External: This email originated outside the ICO. 


Dear ICO 


| would like to submit some additional comments to the consultation regarding the recently 
published SAR guidance. 


P23 — states that organisations cannot ‘stop the clock’ whilst seeking clarity from applicants as to 
the information they are requesting. This conflicts with Recital 63 that states ‘where the controller 
processes a large quantity of information .... The controller should be able to request that, before 
the information is delivered, the data subject specify the information or processing activities to 
which the request relates.’ 


In addition, it seems highly inappropriate for a controller to start retrieving all information held 
about a data subject when it hasn't received confirmation as to what information is actually 
required. Surely that would mean we could be processing an excessive amount of their data 
unnecessarily and that conflicts with the GDPR principle which states that the data we process 
should be limited to what is necessary. 


Kind regards. 


Isle of Wight NHS Trust 


Internal Ex = 


Externa 


